What the research found
A study published in 2026 tracked what happened when three major Canadian banks rolled out two-factor authentication (2FA) — the extra login step beyond just a password — during 2021–2022. Two banks made it optional. One made it mandatory. Researchers then analyzed cyber threat intelligence from criminal marketplaces to see which accounts were actually showing up as compromised.
The result was clear: mandatory 2FA significantly reduced the number of compromised accounts. Optional 2FA did not — even though it was available to everyone. Having the option to be safer wasn’t enough; only requiring it moved the needle.
This tracks with what large platforms report from their own systems: Microsoft has stated that MFA blocks over 99.9% of automated account-compromise attempts, and Google’s research shows that adding even a simple recovery phone number can block the vast majority of bulk phishing and bot-driven attacks.
Why this matters for you personally
